Feature proposal #5279
closed
Schemes should be restricted to valid ones.
http and https are sure valid ones.
javascript:...
file:... (e.g. could be misused for / etc / pass)
are very dangerous ones and should not be allowed.
A positive restrictive list for http and https is sure ok, rest I don't see any real application.
Right, only support for HTTP and HTTPS should be allowed.
- Status changed from Assigned to Resolved
- % Done changed from 0 to 100
Implemented in MR !1190
Only http and https schemes allowed. ALL others will be stripped. This is now more secure than previously as previously we only stripped mailto:, http://, and https://. If no scheme is supplied it falls back to http://.
- Status changed from Resolved to Closed
Also available in: Atom
PDF